Allow access to repositories for active accounts without login permission

[lenidh]

• Gitea version (or commit ref): 1.4.1
• Git version: 2.11
• Operating system: Linux
• Database (use [x]):
  • PostgreSQL
  • MySQL
  • MSSQL
  • SQLite
• Can you reproduce the bug at https://try.gitea.io:
  • Yes (provide example URL)
  • No
  • Not relevant

Description

The current behaviour was introduced with PR #3887 and #3889. Before it worked as expected.

Expected behaviour

A user account with "Account activated" and "Login disabled" both enabled should not be able to login into the web interface but may access a git repository to which access was granted.

Actual behaviour

A user account with "Account activated" and "Login disabled" both enabled can neither access the web interface nor a git repository.

Screenshots

Account options:

Output when accessing a repository:

[techknowlogick]

I think you would be able to use read-write deploy keys for this use-case.

[lunny]

I would like the current behaviour.

[lunny]

For non-actived user, he's profile cannot be view by others and his repository will not be visited too.
For login disabled user, he's profile and repository could be visited but he cannot login and cannot change his settings and repositories and cannot clone his private repositories.

[JacquesOfAllTrades]

Since this issue is still open, I'd like to go on record by agreeing with @lunny. I would interpret "login disabled" to mean that the user's ability to authenticate has been revoked. And if the user isn't allowed to authenticate, they're in effect anonymous, meaning they can access only resources that are public.

Furthermore, it would be a major security hazard if a Gitea update suddenly granted new privileges to disabled users.

The Deploy Key approach seems reasonable. Or simply strip the user in question of all privileges except access to the necessary repository(ies).

[zeripath]

Of note, it's possible for site Admin users to Sudo as these accounts under the API.

[stale]

This issue has been automatically marked as stale because it has not had recent activity. It will be closed if no further activity occurs during the next 2 weeks. Thank you for your contributions.

[lunny]

I think this could be closed now. Please feel free to reopen it.